Denkploeg has three layers. The platform is the code, the same for everyone. An agency has clients, a brand style and an account. A workspace is one client of that agency, and all data hangs off it. An agency is a container for people, reuse and the account. What happens in a workspace stays in that workspace.
You manage your agency on Agency (/agency/<your-agency>). If you work for several clients, this is your starting point.
The screens of Agency
| Screen | What you do there | Who |
|---|---|---|
| Overview | See how many client workspaces there are, which have activity and what is waiting for a signature | everyone with agency access |
| Client workspaces | A card per client, with status, usage, who works on it and what is to be signed. Search, filter, create a new one with a template, open, set up | everyone; setting up only owner and administrator |
| Assign | Give each member a role per client: reader, maker or administrator. See Assigning agency members | owner and administrator; a member only sees their clients |
| Seats and storage | How many people and how much storage you use against your package. See Seats and storage | owner and administrator |
| Templates | Set up a client in minutes. See Templates | owner and administrator |
| Price list and licences | Your package, your price list and the licence per client. See Price list and licences | owner and administrator; the owner makes changes |
| Move or leave | A client to another agency, on its own or away. See Move or leave | owner and administrator; the owner signs |
| People | Who belongs to the agency, with which role and second step: search, invite, change a role, reset a second step, sign out or remove from the agency. See Managing the people of your agency | the owner makes changes; an administrator sees the list |
| Usage | What all workspaces cost together, and the agency cap | owner and administrator |
| Brand and appearance | The brand style of the agency itself: colour and logo, with the contrast rule shown | owner |
| Settings | The agency profile and company details; keys and subscriptions are under Connections | owner and administrator; only the owner sets AI keys and company details |
| Processors | Who processes personal data, per layer. See The processor chain | owner and administrator, read-only |
| History | What happened at the agency and its workspaces, as readable sentences. See History | owner and administrator |
| Connections > Connect Denkploeg | Keys for another system that reads your clients | owner |
| Connections > GitHub | GitHub organisations for all clients of the agency at once | owner and administrator |
You only see the screens your role may use.
Workspaces
Every client gets a workspace of its own with its own address, its own vault and its own audit trail. A new workspace is created by Denkploeg platform administration, not by this screen: the ID goes with it, and an ID can never be reused, not even if the workspace has been stopped, because the audit trail underneath stays attached to it.
On Clients you choose Set up for a client for:
- Name and status. The name that is shown everywhere, and whether members can still join. Stop workspace switches off access and removes it from your agency. Reopening is done by platform administration, so this is a deliberate step.
- Company details. Where the client can be found, and who signs on their behalf.
- Brand. Whether the client has a brand profile and logos. Without an active brand profile, a client shows everywhere as a name without a logo.
- Modules. Which studios the client takes: Creative, Design, Video, Marketing, Commerce, Support, Avatar and Dev and ops. Studios are off by default. A studio that is not ready yet is marked as such and cannot be switched on. A studio that is off is there for the client but cannot be opened.
A client with several brands can keep them in one workspace, see Own brand and client brands.
Demo, pause and archive
A workspace is always in one of these states, and your client sees which one at the top in the bar.
- Demo: works as usual, with an end date and a small cap on usage. Seven days before the end the client gets a reminder. When the demo runs out, the workspace becomes read-only.
- Paused: everything stays readable, but nothing can be changed, generated or published. The client reads who to contact: the contact address you set under Announcements, otherwise the support window. As an agency you cannot lift a pause set by the platform.
- Archived: closed to your client, you can still read along. Keys and open invitations are withdrawn and the owner gets an email with a link to an export (the data, the members, the brands and all files in one zip, valid for thirty days).
- Deleted: only after 90 days of archive, with an export made, and only by Denkploeg. After that the content is erased. The audit trail and the invoices are kept.
Under Client messages you send a message to all your clients or to one workspace. It shows in the bell and in the bar. Replies go through the support window; there is no chat.
Team, roles and who sees what
There are two kinds of roles: a role at the agency, and a role in a workspace.
Roles at the agency
| Role | What it may do |
|---|---|
| Owner | Everything at the agency: manage workspaces, members, rates and caps, costs, working methods, and the connection keys. There is always at least one owner. |
| Administrator | Manage workspaces, see working methods and costs. Has no say over who belongs to the agency, over money or over keys. |
| Member | Only works along in the workspaces they were separately added to. Without that assignment a member sees nothing. |
An owner or administrator gets the role administrator in the agency's workspaces. That is never owner: who decides in a client workspace who may join is a deliberate act and not something you inherit. An agency member inherits nothing. They need a real membership in the workspaces where they work, and that is the difference between "works here" and "can get at everything".
Under People you invite someone with a role, change a role, reset a second step or remove someone from the agency. An invitation works the same for an existing account and a new address: the other person only becomes a member when they open the link. See Managing the people of your agency.
Roles in a workspace
| Role | Sees and does |
|---|---|
| Owner | Everything in the workspace, including deciding who may join. This is usually the client, or yourself for your own workspace. |
| Administrator | Sign, spend money, manage the client's keys, see costs, set the brand profile, read the audit trail and set up the Support Studio. Has no say over access. |
| Maker | Do the work: start a batch, choose a model, see costs, answer conversations. Does not sign off. |
| Reader | Watches along. Has no rights, sees no costs. |
| Client | The client themselves, from outside: the same rights as a reader, so no costs, and no view from the inside of how the agency works. |
What a role may do is fixed in code and cannot be changed in a screen. A permissions matrix you can edit in a screen is a screen in which someone accidentally gives themselves everything. Signing always stays with a human on a screen: no key and no connection can issue a signature.
Per workspace you manage who may join under Access in the portal of that workspace.
Keys per agency
There are three kinds of keys, each with its own boundary. Do not mix them up.
| Key | What for | Where |
|---|---|---|
| AI keys (Anthropic, OpenAI, ElevenLabs, image providers) | Run paid work on your own account | Agency, Connections, or per workspace. Clients set their own keys; the agency's keys only apply to clients if you share them (see below). See Your own AI keys. |
Machine token (dpl_...) | Let one AI client (Claude, Codex) work in one workspace | In the workspace, under Connections > Denkploeg in Claude. Belongs to one workspace and carries a role; signing is possible with no role. See Connecting via MCP. |
Connection key (dpb_...) | Let another system, such as your client portal, read which clients you have and what their brand profile is | Agency, Connection keys |
Sharing with workspaces
Clients set their own keys and accounts (OpenArt, Higgsfield and the rest) on their own workspace. Your keys and accounts as an agency therefore do not automatically work for your clients. If you want generation to run for everyone, you choose that yourself, under Connections, Sharing with workspaces (owner only):
| Choice | What it means |
|---|---|
| Do not share | Default. Only the agency's own work uses your key or account. |
| All workspaces of the agency | Every workspace without its own key or account runs on yours. |
| Selected workspaces | Only the workspaces you tick. |
You choose per provider or service. Only tools and credit can be shared: AI keys, Recraft, WinningHunter, Context, OpenArt and Higgsfield. A connection that fetches data for a single client, such as Google Analytics 4, Search Console, Clarity, ad accounts (Meta, Google Ads) and shops (Shopify, WooCommerce), is never shared: otherwise a client could reach the data of other clients. Those connections are not in the sharing block; one line says which connected services cannot be shared. A workspace with its own key or account always uses its own. What runs on your key, you pay for, and you see it under Paid for clients: a total per workspace over the last thirty days. An account such as OpenArt you share from the agency's own workspace: pick it under Agency's own workspace in the same block, connect the account there, and it appears in the list. If a workspace moves to another agency, sharing with it stops automatically. Agencies that already had a key are set to All workspaces at launch, so nothing stops working; you can switch that back per provider.
Connection keys
Only an agency owner creates or revokes a connection key. You choose what the key may do:
- See workspaces: which clients there are, with logo and brand version.
- Read brand: the brand profile, the brand files and an embedded view of the brand.
- Send knowledge to an assistant: help items from your portal to a support assistant of the agency, see Knowledge from a portal behind a login. This tick is not on by default.
- Read status: reserved, there is no question that goes with it yet.
A connection key only sees workspaces of this agency. A workspace of another agency returns "not found", even if it exists. It is shown once on screen; in the database there is only a hash. Creating and revoking appear in the audit trail, without the key itself. Revoking is not deleting: "this key existed and was revoked on that day" remains visible. The route for sending knowledge is the only one that writes anything, and only knowledge.
What the crew runs on
By default an agency's crew runs on API credits: with the agency's own API key (you pay Anthropic yourself per call; create one at console.anthropic.com under API keys, a key that starts with sk-ant-api) or otherwise with Denkploeg credits. A personal Claude or Codex subscription as a source is off for an agency unless Denkploeg gives the right: the block does not exist on the screen and the server refuses it. Only a platform administrator can give that right, per agency, and it then applies to all its workspaces. With the right a conversation costs no credits and the crew only uses the agency's own token; a token that was already there stays stored encrypted and returns when the right is given. The rest of this section only applies to an agency with that right.
What actually happens, for an agency with the right, without you setting anything: the crew first uses the Claude subscription, if it is signed in and not full. If it is full or unreachable, the crew uses the agency's own API key (you pay Anthropic yourself per call, never Denkploeg's key). If there is no own key, or it fails, it continues on Denkploeg credits, only if the workspace has credits and at the normal price; otherwise a clear message appears. A workspace that prefers to wait until the subscription has room again chooses that under Usage, When the subscription is full. The screen shows the order and which engine is active now. Images, video, speech and other generation (Gemini images, fal, ElevenLabs) never run on the Claude subscription: they use Denkploeg credits or that provider's own key.
Saving keys, subscription tokens, machine tokens and roles needs a code from your authenticator app (for example Google Authenticator or 1Password). If you have not linked one, the screen first shows the step Set up two-step verification first. Whoever manages an agency has no grace period for the second step: a new owner or administrator sets it up at the first sign-in. An existing owner without it sees a message and cannot do the sensitive actions (keys, tokens, roles, inviting people); the rest of the screen stays usable.
Under Connections you set the agency's engines: a Claude subscription, a Codex subscription, or API credits. The order determines what the crew uses first; if the first runs out, it continues on the next. If nothing is on, the crew can do little, and that is not a fault but this setting. A token for a subscription goes into the vault encrypted and can no longer be retrieved afterwards, not even by us.
Note: on a subscription a call has no per-call price, so a workspace's monthly cap then stops nothing. The tokens are counted and appear under Usage. Only with API credits does the cap work as a brake. How full a subscription is, we cannot read.
Costs
Under Usage you see what all accessible workspaces cost together this period. These are provider costs, not an invoice to your client. Provider credits are separate from these figures. Open a workspace for the source and usage. An agency cap limits what all workspaces may spend together; the strictest limit wins, even if a workspace itself still has room. What you pass on to your client is your own agreement, and that is why a reader or client sees no costs.
Agency identity
Your agency has its own brand style in its portal: an accent colour and a logo. That is emphatically not the brand style of a client: a client's brand should not colour the interface, because then adjusting an ad colour changes the whole screen, and a client with an almost-black brand gives an unreadable portal.
If your agency has a workspace of its own, it reads its identity by default from the active brand profile of that workspace's own brand, so you maintain it in one place. That is a reason why client concepts should not live in your own brand: see Own brand and client brands. If you want to deviate, switch on Override manually and set the accent colour (hex colour, such as #6E2230) and the logos, for a light and a dark background (png, jpeg or webp, at most 500 kB).
The rules for colour, logo and names
- Only the owner changes the brand style (the right that also applies to rates); an administrator sees it.
- An accent colour is exactly
#rrggbb. The text on the button becomes black or white, whichever gives the most contrast: always 4.5 or more. The button itself must reach at least 3 against the page; if that fails in light or dark, that view falls back to the Denkploeg yellow. Text in your colour gets a darker or lighter variant that stays readable. The screen shows this before you save. - A logo is a png, jpeg or webp up to 500 kB, checked on the bytes and not on the name. An svg is not possible: that is code. If it is too large or of another type it is refused with the reason, and what you set stays on screen.
- A name is 2 to 40 characters of plain text, without control characters. What you set is always shown as text.
- The platform brand does not disappear: under your agency's sign-in screen it says Powered by Denkploeg. Your own address, your own sender and your own tab title come later.
Every change is in the agency's log.
Via Claude or another MCP client
There is also an agency MCP, read-only, with a connection key: you can query workspaces and a client's brand profile and brand files. Writing is only possible via the route for knowledge. An AI client that works in one workspace uses a machine token, see Connecting via MCP.
Update 22 October 2026
Connected agency providers are collapsed by default. Missing or unreadable credentials open for attention. Expanding a provider retains the existing protected credential and sharing forms.